Delegated Management

Receipt verification

Note

Currently only AES-CMAC receipts are supported.

To enable receipt verification when using delegated management authorized operations, specify the receipt key with --receipt-key. If the receipt verification fails, gp will exit with a non-null exit code. To ignore receipt verification (while still providing the receipt key as an argument), use the --force.

Configuring Receipt Generation

A security domain with the ReceiptGeneration privilege is responsible for generating the receipts for executed operations. By default it is the Issuer Security Domain (ISD). To create a different domain, use:

$ gp -domain 112233445566 -privs ReceiptGeneration

To enable ReceiptGeneration, key with version number 0x71 must be loaded into the security domain with ReceiptGeneration privilege.

$ gp -connect 112233445566 -put-key aes:404142434445464748494a4b4c4d4e4f -new-keyver 0x71